AZDO.1013 - Organization Owner should not be an individual.
Overview
Azure DevOps organization owner should not be assigned to a regular user.
Rationale: Owner has full administrative control over the organization, including the ability to manage users, projects, and settings. They can also configure security policies, access levels, and billing information. Ensure that the owner is aware of their responsibilities and has the necessary permissions to effectively manage the organization.
This query will check if the owner has any of the following words as part of their name to conclude that it is not a regular user: (adm|admin|btg|svc|service)
Remediation action
Ensure that the owner is not a regular user.
- Sign in to your organization.
- Choose Organization settings.
- Select Overview > Change owner.
- Select an identity from the dropdown menu, or search for an identity by entering the identity's name, and then select Change.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1013 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Users and access |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| PowerShell test | Test-AzdoOrganizationOwner |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/change-organization-ownership?view=azure-devops |